Artificial intelligence is spreading faster than companies can frame it: this is one of the key insights from the 2026 Data & AI Barometer published by Coface and Les Echos Etudes. Sensitive data, authorised uses, human validation, responsibilities… Because adopting AI in companies is about more than just selecting a tool, follow this checklist of four key steps to set up a concrete framework and move from experimentation to real impact.
When uses are (too) far ahead of the rulebook
As artificial intelligence (AI) becomes increasingly embedded in companies' practices, the question of how to regulate it becomes unavoidable. And rightly so: automated reporting, analysis of a customer portfolio, detection of a weak signal… AI most often spreads initially through the ways in which teams use it, even before a corporate policy has been defined.
However, for the vast majority of companies, whilst AI has been widely adopted, its governance framework has yet to be established. The Data & AI Barometer 2026, published by Coface and Les Echos Etudes and based on a survey of 900 french decision-makers, confirms this: 60% of companies have not yet formalised a framework, of which more than a third currently have no framework whatsoever and do not plan to put one in place in the near future, whilst a quarter are considering it without having yet formalised any rules.
The priority, therefore, is not to immediately build a comprehensive system, but rather to structure a framework understood by all staff and to set common rules to enable teams to harness the power of AI without compromising the company’s data, decisions or liability.
Successfully rolling out AI within a company does not necessarily begin with a lengthy policy document or the purchase of a new digital platform.
The first milestone rests on four strategic actions:
- protecting the right data,
- selecting proportionate uses,
- organising human oversight
- assigning responsibilities.
A deliberately simple foundation, yet solid enough to move from experimentation to real-world impact.
Step 1: draw a clear boundary between different datasets
Customer, financial, personal or strategic information: not all data is suitable for use with just any tool. This is particularly because different types of data have varying levels of sensitivity. Public data, a payment history, a customer database or a cash flow forecast cannot all be treated in the same way.
Start by dividing your datasets into three categories:
- data that can be freely used in approved tools;
- data requiring special precautions, such as anonymisation or restricted access;
- data to be excluded from the external AI service.
For any finance director, credit manager or head of risk, this sorting process acts as an initial safeguard, ensuring that the immediate time savings generated by AI do not turn into a confidentiality or compliance risk for the company.
Step 2: Define use cases and scope of application
Do not be misled by an appealing use case: it is not necessarily a good starting point for your project within the organisation. Here, the use of AI must, above all, meet a specific business need. Generating a report, carrying out a portfolio review or identifying unusual variations are actions that do not expose the company to risk in the same way: they have neither the same impact nor the same level of risk.
Clearly and simply define the uses into three categories:
- uses authorised with complete autonomy;
- uses subject to monitoring;
- uses conditional upon prior approval.
Next, define the scope of use for each of these categories and link them to a specific metric: processing time, relevance of alerts, adoption rate or reduction in manual tasks.
This approach allows you to quickly test the project’s value before committing more significant resources.
Step 3: Define the level of AI autonomy
AI can carry out large-scale analysis, detect discrepancies and make recommendations, but the risk to avoid is that it becomes, by default or automatically, the decision-maker for all your decisions, including the most sensitive ones.
To summarise, the more a decision commits the organisation, the more clearly the role of human expertise and oversight must be defined. For example, refusing a credit limit, selecting a supplier, assessing a case of fraud or entering a new market are strategic decisions with financial, commercial or regulatory consequences that can have a significant impact on your organisation.
You should therefore identify the nature of the decisions and the stages of your processes where human expertise, verification and validation provide real added value. The aim is not to monitor every single output, but to focus expertise where an error could cost your business the most.
Step 4: Define roles and responsibilities
In companies, as in any collective project, if everyone is in charge… no one takes responsibility (or even takes action)!
Data, IT, business units, legal and compliance: AI involves several functions and different teams within your organisation. But shared responsibility must not mean diluted responsibility. Each use case must have a clearly identified owner.
For all your projects, clearly define (and communicate regularly!) to the various teams who is responsible for what, based on the actions to be carried out:
- who authorises the testing,
- who monitors
- who makes the final decision.
This explicit allocation speeds up decision-making and ensures consistency, whilst preventing a project from getting bogged down in a series of approvals due to a lack of a clear point of responsibility. You should also schedule regular reviews of your AI framework: the tools, the data used and the risks may change.
Data & AI > move from experimentation to impact
>Turn your commercial risk management into a driver of growth: Download Coface’s global study and access the Open Advantage, 5 key strategies to unlock your growth.
